PkgSeer

Vulnerability GO-2026-6568

Unknown

6 hours ago

Gardener: Authorization Bypass via Group Subject Injection in gardener/gardener

v0.32.0 - v1.152.0

Summary

Gardener: Authorization Bypass via Group Subject Injection in gardener/gardener

Details

Gardener: Authorization Bypass via Group Subject Injection in gardener/gardener.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/gardener/gardener from v1.143.0 before v1.143.3, from v1.144.0 before v1.144.2.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Gardener: Authorization Bypass via Group Subject Injection

v0.32.0 - v1.142.5 GHSA-gfjv-gqf2-c888

Gardener allows bypassing project secret validation which can lead to privilege escalation in github.com/gardener/gardener

v0.32.0 - v1.116.3 GO-2025-3696

Gardener allows metadata injection for a project secret which can lead to privilege escalation in github.com/gardener/gardener

v0.32.0 - v1.116.3 GO-2025-3698

Gardener allows metadata injection for a project secret which can lead to privilege escalation

v0.32.0 - v1.116.3 and v1.117.0 - v1.117.4 and v1.118.0 - v1.118.1 GHSA-9x73-87fh-54w9

Gardener allows bypassing project secret validation which can lead to privilege escalation

v0.32.0 - v1.116.3 and v1.117.0 - v1.117.4 and v1.118.0 - v1.118.1 GHSA-3hw7-qj9h-r835

View all vulnerabilities for these packages

Impacted packages

github.com/gardener/gardener

Timeline

Published

6 hours ago

Last Modified

6 hours ago